@bonesofspring/ai-rules 0.2.6 → 0.2.8

package/presets/claude/java/skills/write-adr/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: write-adr
+description: Author an Architecture Decision Record (ADR) with Context, Decision, Consequences, and Links. Use when capturing a durable technical choice for the team.
+---
+
+# Write ADR
+
+On-demand skill for durable architecture decisions. Stack-agnostic sections — fill with project-specific paths and links.
+
+## When to use
+
+- Choosing between non-trivial alternatives (storage, layering, library, API shape).
+- Recording a decision that future agents/humans should not silently reverse.
+- User asks for an ADR, decision log, or “why did we pick X”.
+
+## Template
+
+Create (or append) a short markdown ADR in the repo’s agreed location (e.g. `docs/adr/`, `.cursor/team/`, wiki). Suggested filename: `NNNN-short-title.md`.
+
+```markdown
+# ADR NNNN: <Title>
+
+## Context
+What problem / constraint / force requires a decision?
+
+## Decision
+What we chose (one clear option). Include rejected alternatives briefly if useful.
+
+## Consequences
+Positive and negative outcomes; follow-up work; what becomes harder.
+
+## Links
+Related PRs, issues, rules, prior ADRs, diagrams.
+```
+
+## Guidelines
+
+- Prefer one decision per ADR.
+- Keep Context factual; Decision imperative and short.
+- Link living gotchas to `team/conventions.md` when the decision becomes a recurring local pattern.
+- Do not put ADR bodies only in root `AGENTS.md` (overwrite on init).

package/presets/claude/java/team/README.md

@@ -0,0 +1,27 @@
+# Agent team artifacts (preset java)
+
+Каталог артефактов пайплайна «команда агентов» для Java backend (hexagonal / ports & adapters).
+
+## Layout
+
+```
+.claude/team/
+  active-task.json
+  fixtures/
+  tasks/<slug>/
+    pipeline.json
+    status.json
+    brief.md
+    decomposition.md
+    …
+```
+
+## Fixtures
+
+| Fixture | Notes |
+|---------|-------|
+| `feature-full.json` | Full profile; QA scope `e2e-only` = **adapter/integration tests** (not UI e2e); Playwright/XCUITest stems in `skipped` |
+| `feature-light.json` | developer → build-verifier (`mvn test` / `./gradlew test` / configured static analysis) |
+| `bugfix-standard.json` | debugger → developer (skipIf) → verifier → reviewer |
+
+**Never** schedule Playwright/XCUITest-only steps for this preset. Use `integration-test-*` (or QA with `e2e-only` = integration) for adapter-level coverage.

package/presets/claude/java/team/conventions.md

@@ -0,0 +1,21 @@
+# Living conventions (team)
+
+Consumer-owned store for post-init gotchas, patterns, and decisions. **Not** always-on. Fill after `ai-rules init`. Root `AGENTS.md` only points here.
+
+## Gotchas
+
+<!-- e.g. fragile flows, “never do X in this repo” -->
+
+-
+
+## Patterns
+
+<!-- local patterns beyond reference-features table -->
+
+-
+
+## Decisions
+
+<!-- short pointers to ADRs / product choices that affect code -->
+
+-

package/presets/claude/java/team/fixtures/bugfix-standard.json

@@ -0,0 +1,37 @@
+{
+  "slug": "example-bugfix-standard",
+  "intent": "bugfix",
+  "profile": "standard",
+  "summary": "Regression fix with review",
+  "steps": [
+    {
+      "agent": "debugger",
+      "label": "Root cause"
+    },
+    {
+      "agent": "feature-developer",
+      "label": "Fix if needed",
+      "skipIf": "debugger.fixed"
+    },
+    {
+      "agent": "build-verifier",
+      "label": "mvn test / ./gradlew test / static analysis"
+    },
+    {
+      "agent": "code-reviewer",
+      "label": "Code review"
+    }
+  ],
+  "humanGates": [],
+  "autoChain": true,
+  "skipped": [
+    {
+      "agent": "playwright-test-planner",
+      "reason": "Java backend uses integration-test-* — not in this bugfix path"
+    },
+    {
+      "agent": "xcuitest-test-planner",
+      "reason": "Java backend uses integration-test-* — not in this bugfix path"
+    }
+  ]
+}

package/presets/claude/java/team/fixtures/feature-full.json

@@ -0,0 +1,25 @@
+{
+  "slug": "example-feature-full",
+  "intent": "feature",
+  "profile": "full",
+  "summary": "Multi-layer Java use case with integration-test coverage",
+  "steps": [
+    { "agent": "task-analyst", "label": "Clarify and decompose" },
+    { "agent": "solution-architect", "label": "Design boundaries", "model": "strong" },
+    { "agent": "feature-developer", "label": "Implement + unit tests", "scope": "unit-in-dev" },
+    { "agent": "build-verifier", "label": "mvn test / ./gradlew test / static analysis", "model": "cheap" },
+    { "agent": "security-reviewer", "label": "Security review", "model": "strong" },
+    { "agent": "code-reviewer", "label": "Code review", "model": "cheap" },
+    { "agent": "qa-tester", "label": "Integration tests", "scope": "e2e-only" },
+    { "agent": "integration-test-planner", "label": "Plan integration coverage" },
+    { "agent": "integration-test-generator", "label": "Generate integration tests" }
+  ],
+  "humanGates": ["after:task-analyst"],
+  "autoChain": true,
+  "skipped": [
+    {
+      "agent": "accessibility-reviewer",
+      "reason": "Java backend has no UI surface"
+    }
+  ]
+}

package/presets/claude/java/team/fixtures/feature-light.json

@@ -0,0 +1,17 @@
+{
+  "slug": "example-feature-light",
+  "intent": "feature",
+  "profile": "light",
+  "summary": "Trivial single-package change with explicit AC",
+  "steps": [
+    { "agent": "feature-developer", "label": "Implement", "model": "cheap" },
+    { "agent": "build-verifier", "label": "mvn test / ./gradlew test / static analysis", "model": "cheap" }
+  ],
+  "humanGates": [],
+  "autoChain": true,
+  "skipped": [
+    { "agent": "task-analyst", "reason": "Explicit AC and single-package scope" },
+    { "agent": "code-reviewer", "reason": "Light profile — non-trivial module/service changes should use standard" },
+    { "agent": "qa-tester", "reason": "No integration-test AC" }
+  ]
+}

package/presets/claude/next/CLAUDE.md

@@ -2,6 +2,8 @@
 
 Краткая точка входа для Claude Code. Подробные правила — модульные файлы под `rules/` (подпапки по темам).
 
+**Repo-root agents:** see [`AGENTS.md`](../../AGENTS.md) at the project root (cross-tool setup, commands, security, living conventions pointers).
+
 See @rules/README.md for the full catalog and loading strategy.
 
 ## Conventions
@@ -24,6 +26,8 @@ See @rules/README.md for the full catalog and loading strategy.
 | После правок кода | `rules/tooling-and-review/post-change-lint.md` (**requestable**, обязателен после edits) |
 | Валидация перед review | agent `build-verifier` |
 | Code review MR | skill `code-review` + `rules/tooling-and-review/code-review-mr.md` |
+| Security (auth/forms/env) | `rules/tooling-and-review/security-next.md` + agent `security-reviewer` |
+| Как работает X | agent `codebase-analyzer` (explain-as-is; без `/task`) |
 | Техническое ретро | `commands/technical-retro.md` + skill `technical-retro` |
 
 ## Install
@@ -32,4 +36,4 @@ See @rules/README.md for the full catalog and loading strategy.
 npx @bonesofspring/ai-rules init claude --preset next
 ```
 
-Копирует `CLAUDE.md`, `rules/**`, `commands/**`, `agents/**`, `hooks/**`, `team/**`, `MCP.md` в `.claude/`, плюс `mcp.json` → **`.mcp.json`** в корне проекта.
+Копирует `CLAUDE.md`, `rules/**`, `commands/**`, `agents/**`, `hooks/**`, `team/**`, `MCP.md` в `.claude/`, плюс `mcp.json` → **`.mcp.json`** и `REPO_AGENTS.md` → корневой **`AGENTS.md`**. Skills: `write-adr`, `react-performance` (on-demand).

package/presets/claude/next/README.md

@@ -30,5 +30,10 @@ Cursor-пресет и Claude-пресет используют один и то
 
 - `/task <desc>` → `task-router` → `pipeline.json`;
 - `/task-continue <slug>` → продолжение после human gate;
-- `.claude/agents/*.md` → **21** ролей: planning (router, analyst, architect, migration, api-contract), implementation (debugger, ci-investigator, developer), review (code, a11y, security, perf), testing (QA, unit trio, playwright trio), docs (tech-writer), build (build-verifier);
+- `.claude/agents/*.md` → **22** ролей: planning (router, analyst, architect, migration, api-contract), analysis (`codebase-analyzer`), implementation (debugger, ci-investigator, developer), review (code, a11y, security, perf), testing (QA, unit trio, playwright trio), docs (tech-writer), build (build-verifier);
 - `.claude/team/tasks/<slug>/` → handoff-артефакты (`brief.md`, `decomposition.md`, `review.md`, `migration-plan.md`, `ci-report.md`, `status.json`, …).
+
+## Cross-tool root AGENTS
+
+`REPO_AGENTS.md` → project-root `AGENTS.md` on init. Living conventions: `team/conventions.md`. Skill `write-adr` on-demand.
+Next also ships `react-performance` skill and Incorrect/Correct samples on golden domain rules.

package/presets/claude/next/REPO_AGENTS.md

@@ -0,0 +1,48 @@
+# Next.js — agent instructions
+
+Cross-tool repo-root guide. Tool-specific maps stay under `.cursor/AGENTS.md` and `.claude/CLAUDE.md`.
+
+## Cross-tool setup
+
+- Treat this file as the **shared** entry for any agent (Cursor, Claude Code, or other).
+- Tool maps (agent-team tables, slash commands) live in `.cursor/AGENTS.md` / `.claude/CLAUDE.md` — use them when that tool is installed.
+- Install:
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset next
+npx @bonesofspring/ai-rules init claude --preset next
+```
+
+`init` overwrites this file from the preset (`REPO_AGENTS.md` → `AGENTS.md`). Living gotchas belong in `team/conventions.md`, not here.
+
+## Commands (test / lint / build)
+
+Working directory for app scripts: **`app/`**. Detect the package manager from lockfile / `packageManager` (`package-manager` rule).
+
+| Gate | Typical command |
+|------|-----------------|
+| Lint JS | `yarn lint:js` (or project equivalent) from `app/` |
+| Lint CSS | `yarn lint:css` from `app/` |
+| Unit tests | project unit script under `app/` |
+| Build | project `build` under `app/` |
+
+After code edits: invoke **`post-change-lint`** (requestable). Full gate: agent `build-verifier`.
+
+## Security basics
+
+- Do not commit secrets (`.env`, tokens, credentials).
+- Review destructive git (`reset --hard`, force-push) before running; respect shell hooks.
+- Do not weaken CI or skip hooks unless the user explicitly asks.
+
+## Tool entry points
+
+| Tool | Map |
+|------|-----|
+| Cursor | `.cursor/AGENTS.md` (optional if Cursor not installed) |
+| Claude Code | `.claude/CLAUDE.md` (optional if Claude not installed) |
+
+Rules: `.cursor/rules/` or `.claude/rules/`. Skills: `.cursor/skills/` or `.claude/skills/`.
+
+## Living conventions
+
+Gotchas, local patterns, and team decisions: **`.cursor/team/conventions.md`** and/or **`.claude/team/conventions.md`** (fill after init; not overwritten on every dogfood sync when already present).

package/presets/claude/next/agents/README.md

@@ -12,6 +12,12 @@
 | Migration planner | `migration-specialist.md` | no |
 | API contract reviewer | `api-contract-reviewer.md` | no |
 
+## Analysis (on-demand)
+
+| Agent | Файл | Production-код |
+|-------|------|----------------|
+| Codebase analyzer | `codebase-analyzer.md` | no (explain-as-is only) |
+
 ## Implementation and CI
 
 | Agent | Файл | Production-код |
@@ -56,7 +62,7 @@ SoT по умолчанию — YAML `model` в каждом agent-файле.
 
 | Tier | Default frontmatter | Agents |
 |------|---------------------|--------|
-| **cheap** | `fast` | `task-router`, `task-analyst`, `build-verifier`, `code-reviewer`, `tech-writer` |
+| **cheap** | `fast` | `task-router`, `task-analyst`, `build-verifier`, `code-reviewer`, `tech-writer`, `codebase-analyzer` |
 | **standard** | `inherit` or `sonnet` | `feature-developer`, `debugger`, `ci-investigator`, `api-contract-reviewer`, `accessibility-reviewer`, `qa-tester`, `unit-test-*`, `playwright-test-*` (`sonnet` where already pinned) |
 | **strong** | `opus` | `solution-architect`, `migration-specialist`, `security-reviewer`, `performance-auditor` |
 

package/presets/claude/next/agents/build-verifier.md

@@ -35,11 +35,16 @@ When validating **preset packaging** changes (paths under `packages/ai-rules/pre
 2. **Leakage (next):** hooks/agents must not require `xcuitest-test-*` handoffs or `xcodebuild` as the default Next post-change gate. See `tooling-and-review/preset-no-cross-stack-leakage.md`.
 3. **Mapping / README:** `rules/README.md` must include a Cursor→Claude mapping table; document core→stack mapping when `_shared` consumers exist.
 4. **shared-core consumers:** if `_shared/core/**` changed, every file with matching `<!-- shared-core: … -->` in this PR must be updated (or intentional fork documented).
-5. **Twin presence:** Cursor rule change without Claude twin same PR → **FAIL** (next, ios-swift, and go). Domain twin body ≥15 lines; thin aliases may be shorter.
+5. **Twin presence:** Cursor rule change without Claude twin same PR → **FAIL** (next, ios-swift, go, and java). Domain twin body ≥15 lines; thin aliases may be shorter.
 6. **Session-start body budget:** sum body lines of the **3** intended session-start rules ≤ **120** (stretch ≤100); do **not** include `**/README.md` — record in validation-report; FAIL if grossly over.
-7. **Embed drift (soft by default):** run `packages/ai-rules/scripts/check-shared-core-drift.sh`. Document DRIFT; `AI_RULES_DRIFT_FAIL=1` to enforce. Lineage stems excluded from body equality.
+7. **Embed drift (hard in `check:preset-structure`):** run `packages/ai-rules/scripts/check-shared-core-drift.sh` with `AI_RULES_DRIFT_FAIL=1` (bundled by the structure orchestrator). Lineage stems excluded from body equality.
 8. **Dogfood (monorepo soft):** prefer `packages/ai-rules/scripts/sync-dogfood-cursor.sh`; mass dogfood deletion without migration doc → risk / FAIL for maintainers.
 
+9. **Root AGENTS template:** each installable preset (`cursor|claude` × `next|ios-swift|go|java`) must ship `REPO_AGENTS.md` when validating preset packaging → **FAIL** if missing.
+10. **Hooks cookbook:** default `hooks.json` must **not** reference `hooks/examples/` → **FAIL** if it does.
+11. **No react-performance on ios/go/java:** skill directory / required handoff must be absent under ios-swift, go, and java → **FAIL** (leakage). Prefer `check:preset-leakage`.
+12. **Rule eval (WARN):** `scripts/check-rule-eval.mjs` / `yarn check:rule-eval` should exist for maintainers; smoke optional. Hard fail only when the opt-in eval job runs — not part of default `check:preset-structure`.
+
 ### Soft notes
 
 - Thin aliases may be &lt;15 body lines.

package/presets/claude/next/agents/codebase-analyzer.md

@@ -0,0 +1,28 @@
+---
+name: codebase-analyzer
+description: Explains HOW existing code works as-is. Use when the user asks how something works, to trace data flow, or document architecture — without suggesting changes. Prefer over /task for pure questions.
+readonly: false
+model: fast
+---
+
+You are a specialist at understanding HOW this Next.js codebase works. Document implementation details with precise `path:line` references.
+
+## CRITICAL — explain as-is only
+
+- DO NOT suggest improvements, refactors, or "better approaches" unless the user explicitly asks.
+- DO NOT perform root-cause analysis or bug hunts unless asked.
+- DO NOT critique quality, performance, or security unless asked.
+- ONLY describe what exists, how it works, and how components interact.
+
+## Workflow
+
+1. Start from entry points the user named (routes, public barrels `@/api` / `@/types`, feature folders).
+2. Trace calls and data flow across UI → store → API → HTTP as applicable; read each file involved.
+3. Summarize: purpose, flow, contracts between modules, layer placement, conventions observed.
+4. End with open questions only if facts are missing — not with a wishlist of changes.
+
+## Will / Will not
+
+**Will:** map files, call chains, types/mappers, layer boundaries as they exist today.
+
+**Will not:** edit production code; open `/task` pipelines; propose PRs or refactors unprompted.

package/presets/claude/next/agents/feature-developer.md

@@ -20,6 +20,19 @@ You are a senior frontend developer working in a Next.js monorepo with strict la
 - Mark completed tasks in `decomposition.md`.
 - Validation: **`rules/tooling-and-review/post-change-lint.md`**. If pipeline next step is **`build-verifier`**, scoped lint/type-check on **changed files** is enough; full project lint is build-verifier's job.
 
+## Zero improvisation
+
+- Implement **only** what the brief / AC / current decomposition task require.
+- If requirements are ambiguous, conflicting, or multi-way — **ask** before coding; do not guess extras as "best practices".
+- Forbidden without explicit AC/task: unrelated security hardening, extra validation, UI polish, logging/monitoring, drive-by refactors, new config/env.
+- Boy scout / `design-guidance` improvements stay **within** touched files and must not expand task scope.
+
+## Will / Will not
+
+**Will:** follow layer order and reference features; add required unit tests; run the post-change gate; update task artifacts.
+
+**Will not:** formal code review; start blocked/dependent tasks; invent AC; auto-continue the next WP when the pipeline expects a human gate or handoff.
+
 ## On completion
 
 Update `status.json` (`currentAgent`: `feature-developer`, `state`: `completed`). Handoff: tasks done, files by layer, unit specs, validation result, gaps for build-verifier/reviewer.

package/presets/claude/next/agents/security-reviewer.md

@@ -14,9 +14,11 @@ You are a frontend security reviewer for a Next.js TypeScript application.
 
 ## Review scope
 
-- Secrets, tokens, API keys in source or committed env files.
+Load `tooling-and-review/security-next.md` for coding-time invariants. Focus on:
+
+- Secrets, tokens, API keys in source or committed env files; never in `NEXT_PUBLIC_*`.
 - `dangerouslySetInnerHTML`, unsanitized HTML, URL injection.
-- Auth token storage (cookies vs localStorage), refresh flows, 401 handling.
+- Auth token storage (cookies vs localStorage), server-side session verify, refresh flows, 401 handling.
 - CSRF considerations for state-changing requests (as applicable to frontend).
 - Open redirects in navigation/router usage.
 - Sensitive data in client-side logs or error messages.

package/presets/claude/next/hooks/README.md

@@ -6,3 +6,9 @@
 | `guard-shell-command.sh` | Destructive git / package-manager guard |
 
 Wire into Claude Code hooks per project documentation when enabling agent team auto-chain.
+
+## Optional cookbook
+
+Example scripts live in `hooks/examples/` (secret-guard, format-edited, test-on-save). They are **not** auto-enabled.
+
+To wire in Claude Code: copy an `.example.sh` into `hooks/`, make executable, and register per [Claude Code hooks](https://code.claude.com/docs/en/hooks) for your project. Keep stack-safe recipes (this preset: **next**). Cursor twin examples under `presets/cursor/next/hooks/examples/` are the same allowlist forks.

package/presets/claude/next/hooks/examples/README.md

@@ -0,0 +1,18 @@
+# Hooks cookbook (examples)
+
+Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks.json` (only `guard-shell-command.sh` + `chain-team-phases.sh`).
+
+| Script | Purpose |
+|--------|---------|
+| `secret-guard.example.sh` | Fail if staged diff looks like secrets |
+| `format-edited.example.sh` | Stack formatter / linter on edited files |
+| `test-on-save.example.sh` | Scoped tests for the stack |
+
+## Wiring (Cursor)
+
+1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.
+2. `chmod +x hooks/secret-guard.sh`.
+3. Add a hook entry in `.cursor/hooks.json` (e.g. `beforeShellExecution` or `afterFileEdit` — see Cursor hooks docs).
+4. Keep cookbook scripts **out** of the default preset `hooks.json` when contributing back upstream.
+
+Stack: **next** — recipes must stay stack-safe (no cross-stack lint/test commands).

package/presets/claude/next/hooks/examples/format-edited.example.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Optional: format/lint edited JS/TS under app/ after save.
+# NOT in default hooks.json. Requires yarn scripts in app/.
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT/app" 2>/dev/null || cd "$ROOT"
+# Prefer project scripts; adjust names to match package.json
+if command -v yarn >/dev/null 2>&1; then
+  yarn lint:js --fix 2>/dev/null || yarn eslint --fix . 2>/dev/null || true
+fi
+exit 0

package/presets/claude/next/hooks/examples/secret-guard.example.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Optional cookbook: block committing likely secrets in staged diffs.
+# NOT wired in default hooks.json — copy to hooks/ and register manually.
+set -euo pipefail
+PATTERN='(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----|api[_-]?key\s*[:=]\s*['\''\"][^'\''\"]{12,})'
+if git diff --cached -U0 2>/dev/null | grep -Eiq "$PATTERN"; then
+  echo "secret-guard: possible secret in staged diff — review before commit" >&2
+  exit 1
+fi
+exit 0

package/presets/claude/next/hooks/examples/test-on-save.example.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Optional: scoped unit tests for changed files under app/src.
+# NOT in default hooks.json. No Playwright here.
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT/app" 2>/dev/null || exit 0
+yarn test --findRelatedTests --passWithNoTests 2>/dev/null || yarn test --passWithNoTests 2>/dev/null || true
+exit 0

package/presets/claude/next/rules/README.md

@@ -15,7 +15,7 @@
 ## Loading strategy
 
 - **Session start (no `paths:`):** ровно **3** — `next-app-core`, `package-manager`, `code-quality`
-- **On-demand (`paths:` or via commands):** `post-change-lint` (**обязателен после правок кода**), `agent-team-intake`, `agent-team-orchestrator`, `code-review-mr`, architecture, imports, UI, tests, feature-delivery-workflow, `design-guidance`, reference-features, next-app-router, react-a11y-coding, `technical-retro`, **preset-*** meta (paths on `packages/ai-rules/presets/**`)
+- **On-demand (`paths:` or via commands):** `post-change-lint` (**обязателен после правок кода**), `agent-team-intake`, `agent-team-orchestrator`, `code-review-mr`, `security-next`, architecture, imports, UI, tests, feature-delivery-workflow, `design-guidance`, reference-features, next-app-router, react-a11y-coding, `technical-retro`, **preset-*** meta (paths on `packages/ai-rules/presets/**`)
 - **Skills:** long workflows (`feature-delivery`, `code-review`, …)
 
 ### UI edit bundle (consolidated paths)
@@ -63,6 +63,7 @@
 | `playwright-agents.mdc` | `testing/playwright-agents.md` |
 | `post-change-lint.mdc` | `tooling-and-review/post-change-lint.md` |
 | `code-review-mr.mdc` | `tooling-and-review/code-review-mr.md` |
+| `security-next.mdc` | `tooling-and-review/security-next.md` |
 | `agent-team-intake.mdc` | `tooling-and-review/agent-team-intake.md` |
 | `agent-team-orchestrator.mdc` | `tooling-and-review/agent-team-orchestrator.md` |
 | `technical-retro.mdc` | `tooling-and-review/technical-retro.md` |

package/presets/claude/next/rules/api-and-data/api-services.md

@@ -1,6 +1,7 @@
 ---
 paths:
   - app/src/api/services/**/*.ts
+impact: HIGH
 ---
 
 # Роль API слоя
@@ -55,3 +56,24 @@ paths:
   - компоненты не должны зависеть от DTO;
   - store не должен сам собирать URL/коды эндпоинтов и не обходить сервисы; **транспортный тип ответа** и **контракт ошибки** из `@/types` (как у прикладного клиента) допустимы во thunk при разборе `catch`/payload, если так выстроен сервис (см. `api-and-data/store-rtk.md`, `api-and-data/http-client.md`).
 - При использовании API‑сервисов в UI, store и утилитах **вне** `app/src/api/**` импортировать **только** из `@/api` (корневой barrel), см. **`architecture/public-imports.md`**; внутри слоя API — по относительным путям или `@/api/services/**` / `@/api/clients/**`, не дублируя публичный контракт мимо корневого barrel для внешних потребителей.
+## Incorrect
+
+```ts
+// Returning raw DTO to store/UI without mapping
+export const getCard = async (id: string) => {
+  const { data } = await cardsClient.get(`/cards/${id}`)
+  return data // backend DTO leaked upward
+}
+```
+
+## Correct
+
+```ts
+import type { TCard } from '@/types'
+import { mapCardResponse } from './cardResponseMappers'
+
+export const getCard = async (id: string): Promise<TCard> => {
+  const { data } = await cardsClient.get(`/cards/${id}`)
+  return mapCardResponse(data)
+}
+```

package/presets/claude/next/rules/api-and-data/http-client.md

@@ -2,6 +2,7 @@
 paths:
   - app/src/lib/clients/**/*.ts
   - app/src/api/clients/**/*.ts
+impact: HIGH
 ---
 
 # HTTP-транспорт
@@ -38,3 +39,23 @@ paths:
 
 - Меняя реализацию общего клиента — **обновить или добавить behavior‑тесты** рядом с модулем клиента (`testing/tests-unit.md`).
 - Не вводить **второй полноценный HTTP‑стек** без явной задачи и согласования с архитектурой репозитория.
+## Incorrect
+
+```ts
+// Inside api/services — ad-hoc fetch bypasses shared client
+export const getSettings = async () => {
+  const res = await fetch('/api/settings')
+  return res.json()
+}
+```
+
+## Correct
+
+```ts
+import { appHttpClient } from '@/api/clients/appHttpClient'
+
+export const getSettings = async () => {
+  const { data } = await appHttpClient.get('/settings')
+  return mapSettingsResponse(data)
+}
+```

package/presets/claude/next/rules/api-and-data/store-rtk.md

@@ -1,6 +1,7 @@
 ---
 paths:
   - app/src/store/**/*.ts
+impact: HIGH
 ---
 
 # Общие принципы
@@ -63,3 +64,22 @@ paths:
 - Строго типизировать state и actions.
 - Использовать **единый стиль именования actions и селекторов**, как в существующих слайсах.
 - При работе с ошибками и ответами HTTP опираться на **`api-and-data/http-client.md`** и контракты из `@/types`, а не на типы внешних HTTP‑библиотек вне зависимостей проекта.
+## Incorrect
+
+```ts
+export const loadProfile = createAsyncThunk('profile/load', async () => {
+  const res = await fetch('/api/profile')
+  return res.json() // raw DTO into slice
+})
+```
+
+## Correct
+
+```ts
+import { profileApi } from '@/api'
+
+export const loadProfile = createAsyncThunk('profile/load', async () => {
+  // service returns domain model already mapped
+  return profileApi.getProfile()
+})
+```

package/presets/claude/next/rules/architecture/architecture-boundaries.md

@@ -4,6 +4,7 @@ paths:
   - app/src/store/**/*
   - app/src/types/**/*
   - app/src/lib/**/*
+impact: CRITICAL
 ---
 
 # Границы между слоями
@@ -73,3 +74,30 @@ paths:
 - Разместить файлы в **соответствующих слоях**.
 - Проверить существующие фичи с аналогичной структурой и **повторить их организацию**.
 - Не "коротить" слои (например, не вызывать API прямо из компонента только ради упрощения).
+## Incorrect
+
+```ts
+// UI calling HTTP client / deep service path directly
+import { httpClient } from '@/lib/clients/HttpClient'
+import { fetchOrders } from '@/api/services/OrdersApi/orders.service'
+
+export const OrdersPage = () => {
+  // bypasses store and @/api barrel
+  void httpClient.get('/orders')
+  return null
+}
+```
+
+## Correct
+
+```ts
+import { useAppDispatch } from '@/store'
+import { loadOrders } from '@/store/slices/Orders'
+
+export const OrdersPage = () => {
+  const dispatch = useAppDispatch()
+  // UI → store → services from @/api (inside thunk)
+  void dispatch(loadOrders())
+  return null
+}
+```

package/presets/claude/next/rules/architecture/layer-barrel-exports.md

@@ -1,6 +1,7 @@
 ---
 paths:
   - app/src/**/index.ts
+impact: MEDIUM
 ---
 
 # Barrel-экспорты слоёв с public API
@@ -56,3 +57,17 @@ paths:
 | Core | `app/src/core/index.ts` | ESLint: `@/core/index` |
 
 Иллюстрация двух уровней (API): локальный `services/.../<Feature>/index.ts` → фасад `*ApiService.ts` → `app/src/api/index.ts`.
+## Incorrect
+
+```ts
+// app/src/api/index.ts — leaking internals
+export { mapCardResponse } from './services/CardsApi/cardResponseMappers'
+export { rawCardsClient } from './clients/rawCardsClient'
+```
+
+## Correct
+
+```ts
+// app/src/api/index.ts — public facade only
+export { cardsApi } from './services/CardsApi'
+```

package/presets/claude/next/rules/architecture/public-imports.md

@@ -5,6 +5,7 @@ paths:
   - app/src/lib/**/*
   - app/src/types/**/*
   - app/src/api/**/*
+impact: HIGH
 ---
 
 # Публичные импорты (`@/types`, `@/api`)
@@ -44,3 +45,16 @@ import { MedcardApiService } from '@/api/services/MedcardApiService/MedcardApiSe
 ```
 
 Новые публичные символы API — реэкспорт в `app/src/api/index.ts` по **`architecture/layer-barrel-exports.md`**.
+## Incorrect
+
+```ts
+import type { TUserProfile } from '@/types/User.types'
+import { OrdersApi } from '@/api/services/OrdersApi'
+```
+
+## Correct
+
+```ts
+import type { TUserProfile } from '@/types'
+import { ordersApi } from '@/api'
+```